MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a7f52bd83f28938809df099294917af28874eb7c1fa3c34e5fba4f8f1c6a0ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a7f52bd83f28938809df099294917af28874eb7c1fa3c34e5fba4f8f1c6a0ec
SHA3-384 hash: 490b5331c4573c47ef22810a5d431887f64ae1ab269b20e01922ebe39aae247507e3cd3711c32c76509d93eacc7d8db7
SHA1 hash: 30cc7e1c26165f04c9e4db6be08a882968ba1999
MD5 hash: 9783e27c84169ca09b2193ec3215cee6
humanhash: skylark-paris-ink-echo
File name:9a7f52bd83f28938809df099294917af28874eb7c1fa3c34e5fba4f8f1c6a0ec
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:210'944 bytes
First seen:2020-11-10 06:53:33 UTC
Last seen:2024-07-24 19:30:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0bc418575efc832b308d227b31192688 (42 x CobaltStrike)
ssdeep 3072:nr8Y+AFZxy8wCY8ccvYGWsJfr+x2AYX89V/fhp66+zWepDCnwolUt2L5huN:L+6Jmhqfre9Lx5+YwoDo
Threatray 269 similar samples on MalwareBazaar
TLSH 02249EA03481D037D04B0039621F8B7E6BF9F9F427B5A447FB884A599E717A3DA29303
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a7f52bd83f28938809df099294917af28874eb7c1fa3c34e5fba4f8f1c6a0ec/
Threat name:
Win32.PUA.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 06:56:08 UTC
AV detection:
36 of 48 (75.00%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tj7vfpmd6ketrae56cmsssixv4uiotvxyh5dynhf7ospr4ogudwa._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
19ef6a3ce60b67cc2f308bc56d3529d2d5ae3454f4e727d746bd8fb1a8ae0fe4
CobaltStrike
1d7dd6d8454853a489cb20618172f5d0d08615aba118176183f6dbeb0c73f218
CobaltStrike
2e7403807afe677a28efe5dbbf2b48edafa90cac07ff2756def2044cf0d19684
CobaltStrike
46bbcc6fde17df7a4ae20797371415a8e3a51346cd5ceee2487e7add0afc8046
CobaltStrike
5debce25fe4c1ca38a79521abb5bb3b88b5d8b24bc0f564373d04371c4d6dd46
CobaltStrike
7ab8b591feb68911c1383d5072f878735201c0f2a9b0f9838e7bfe2f9b634943
CobaltStrike
7ed85f0b66e478f65122238c3fd734ab83b159e7223af7e37013a07b71066971
CobaltStrike
87a74ec523b3f466e698f08721faa276448783f6f1a81a1679a8854668ac2427
CobaltStrike
bb844851de788e926db25a6fcb2e334aa9deb3ef8b76a0ef71b6fc0c6acafee3
CobaltStrike
fa4d61c32a0b0b6c52d9a75bb160c543f3c9730778aea1b005a790ca7c00ffc9
CobaltStrike
+ 259 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/201110-apc7vlsv46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
ServiceHost packer
Cobaltstrike
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_CobaltStrike_Beacon_Indicator
Create hunting rule
Author:JPCERT
Description:Detects CobaltStrike beacons
Reference:https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py
Rule name:CobaltStrike
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CobaltStrike_Sleep_Decoder_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike sleep_mask decoder
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:MALW_cobaltrike
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect CobaltStrike beacon
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip
Rule name:win_cobalt_strike_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments